using System;
using System.Runtime.InteropServices;
using System.Security;
using WindowsAPI.Service;

namespace WindowsAPI
{
    [SuppressUnmanagedCodeSecurity, Dll(FileName)]
    public static class ntdll
    {
        /* ------------------------------------------------------------------------------------------ */

        public const string FileName = "ntdll.dll";

        /* ------------------------------------------------------------------------------------------ */

        [Link("\\Temp\\ntexapi.h")]
        [DllImport(FileName, SetLastError = true)]
        public static extern NT_STATUS ZwQuerySystemInformation(
            [In] SYSTEM_INFORMATION_CLASS SystemInformationClass,
            [In] IntPtr pSystemInformation,
            [In] ulong SystemInformationLength,
            [Optional] out ulong ReturnLength);

        /* ------------------------------------------------------------------------------------------ */

        [DllImport(FileName, SetLastError = true)]
        public static extern IntPtr NtQueryInformationFile(
                    IntPtr fileHandle,
                    ref IO_STATUS_BLOCK IoStatusBlock,
                    IntPtr pInfoBlock,
                    uint length,
                    FILE_INFORMATION_CLASS fileInformation);



        [DllImport(FileName, SetLastError = true)]
        public static extern int NtQueryInformationProcess(
                    IntPtr processHandle,
                    int processInformationClass,
                    IntPtr processInformation,
                    uint processInformationLength,
                    IntPtr returnLength);

        [DllImport(FileName, SetLastError = true)]
        public static extern int NtQueryInformationProcess(
                    IntPtr processHandle,
                    PROCESSINFOCLASS processInformationClass,
                    ref PROCESS_BASIC_INFORMATION processInformation,
                    int processInformationLength,
                    out int returnLength);

        [DllImport(FileName, SetLastError = true)]
        public static extern NT_STATUS NtQuerySystemInformation(
                    [In] SYSTEM_INFORMATION_CLASS SystemInformationClass,
                    [In] IntPtr SystemInformation,
                    [In] int SystemInformationLength,
                    [Out] out int ReturnLength);

        [Link("http://c0dedgarik.blogspot.com/2009/09/blog-post_03.html")]
        [DllImport(FileName, SetLastError = true)]
        public static extern NT_STATUS NtQueryObject(
                    [In] IntPtr Handle,
                    [In] OBJECT_INFORMATION_CLASS ObjectInformationClass,
                    [In] IntPtr ObjectInformation,
                    [In] int ObjectInformationLength,
                    [Out] out int ReturnLength);



        /* ------------------------------------------------------------------------------------------ */
    }

    //[StructLayout(LayoutKind.Sequential)]
    //public struct SYSTEM_TIMEOFDAY_INFORMATION
    //{
    //    LARGE_INTEGER BootTime;
    //    LARGE_INTEGER CurrentTime;
    //    LARGE_INTEGER TimeZoneBias;
    //    ULONG TimeZoneId;
    //    ULONG Reserved;
    //    ULONGLONG BootTimeBias;
    //    ULONGLONG SleepTimeBias;
    //}

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct PROCESS_BASIC_INFORMATION
    {
        public IntPtr ExitStatus;
        public IntPtr PebBaseAddress;
        public IntPtr AffinityMask;
        public IntPtr BasePriority;
        public UIntPtr UniqueProcessId;
        public IntPtr InheritedFromUniqueProcessId;

        public int Size { get { return Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION)); } }
    }

    public enum PROCESSINFOCLASS
    {
        ProcessBasicInformation = 0,
        ProcessQuotaLimits,
        ProcessIoCounters,
        ProcessVmCounters,
        ProcessTimes,
        ProcessBasePriority,
        ProcessRaisePriority,
        ProcessDebugPort,
        ProcessExceptionPort,
        ProcessAccessToken,
        ProcessLdtInformation,
        ProcessLdtSize,
        ProcessDefaultHardErrorMode,
        ProcessIoPortHandlers, // Note: this is kernel mode only
        ProcessPooledUsageAndLimits,
        ProcessWorkingSetWatch,
        ProcessUserModeIOPL,
        ProcessEnableAlignmentFaultFixup,
        ProcessPriorityClass,
        ProcessWx86Information,
        ProcessHandleCount,
        ProcessAffinityMask,
        ProcessPriorityBoost,
        MaxProcessInfoClass,
        ProcessWow64Information = 26,
        ProcessImageFileName = 27
    };
}